HttpOnly

Contents

• 1 Overview
  
  • 1.1 Who developed
    HttpOnly? When?
  
  
  • 1.2 What is
    HttpOnly?
  
  
  • 1.3 Mitigating
    the Most Common XSS attack using HttpOnly
    
    • 1.3.1 Using
      Java to Set HttpOnly
    
    
    • 1.3.2 Using
      .NET to Set HttpOnly
    
    
    • 1.3.3 Using
      Python (cherryPy) to Set HttpOnly
    
    
    • 1.3.4 Using PHP
      to set HttpOnly
  
  
  • 1.4 Web
    Application Firewalls


• 2 Browsers
  Supporting HttpOnly


• 3 Using WebGoat to
  Test for HttpOnly Support
  
  • 3.1 WARNING
  
  
  • 3.2 Getting
    Started
  
  
  • 3.3 Lesson
    Goal
  
  
  • 3.4 Testing Web
    Browsers for HttpOnly Support
    
    • 3.4.1 Disabling
      HttpOnly
    
    
    • 3.4.2 Enabling
      HttpOnly


• 4 References

Overview

The goal of this section is to introduce, discuss, and provide
language specific mitigation techniques for HttpOnly.

Who
developed HttpOnly? When?

According to a daily blog article by Jordan Wiens, “No cookie for
you!,” HttpOnly cookies were first implemented in 2002 by Microsoft
Internet Explorer developers for Internet Explorer 6 SP1. Wiens, [1]

What
is HttpOnly?

According to the Microsoft Developer Network, HttpOnly is an
additional flag included in a Set-Cookie HTTP response
header. Using the HttpOnly flag when generating a cookie helps
mitigate the risk of client side script accessing the protected
cookie (if the browser supports it).

• The example below shows the syntax used within the
  HTTP response header:

Set-Cookie: <name>=<value>[; <Max-Age>=<age>]

[; expires=<date>][; domain=<domain_name>]

[; path=<some_path>][; secure][; HttpOnly]

If the HttpOnly flag (optional) is included in the HTTP response
header, the cookie cannot be accessed through client side script
(again if the browser supports this flag). As a result, even if a
cross-site scripting (XSS) flaw exists, and a user
accidentally accesses a link that exploits this flaw, the browser
(primarily Internet Explorer) will not reveal the cookie to a third
party.

If a browser does not support HttpOnly and a website attempts to
set an HttpOnly cookie, the HttpOnly flag will be ignored by the
browser, thus creating a traditional, script accessible cookie. As a
result, the cookie (typically your session cookie) becomes
vulnerable to theft of modification by malicious script. Mitigating,
[2]

Mitigating the Most Common XSS
attack using HttpOnly

According to Michael Howard, Senior Security Program Manager
in the Secure Windows Initiative group at Microsoft, the majority of
XSS attacks target theft of session cookies. A server could help
mitigate this issue by setting the HTTPOnly flag on a cookie it
creates, indicating the cookie should not be accessible on the
client.

If a browser that supports HttpOnly detects a cookie containing
the HttpOnly flag, and client side script code attempts to read the
cookie, the browser returns an empty string as the result.
This causes the attack to fail by preventing the malicious (usually
XSS) code from sending the data to an attacker‘s website. Howard,
[3]

Using
Java to Set HttpOnly

Since Sun Java Enterprise Edition 6 (JEE 6), that adopted Java
Servlet 3.0 technology, it‘s programmatically easy setting HttpOnly
flag in a cookie.

In fact setHttpOnly and isHttpOnly
methods are available in the Cookie interface [4], and also for session cookies (JSESSIONID) [5]:

Cookie cookie = getMyCookie("myCookieName");

cookie.setHttpOnly(true);

Moreover since JEE 6 it‘s also declaratively easy setting
HttpOnly flag in session cookie, by applying the
following configuration in the deployment descriptor
WEB-INF/web.xml:

<session-config>

 <cookie-config>

  <http-only>true</http-only>

 </cookie-config>

</session-config>

For Java Enterprise Edition versions prior to JEE 6 a
common workaround is to overwrite the
SET-COOKIE http response header with a session cookie
value that explicitly appends the HttpOnly flag:

String sessionid = request.getSession().getId();

// be careful overwriting: JSESSIONID may have been set with other flags

response.setHeader("SET-COOKIE", "JSESSIONID=" + sessionid + "; HttpOnly");

In this context overwriting, despite appropriate for the
HttpOnly flag, is discouraged because JSESSIONID may
have been set with other flags. So a better workaround is taking
care of the previously set flags or using the ESAPI#Java_EE
library: in fact the addCookie method of the
SecurityWrapperResponse [6] takes care of previously set falgs for us. So
we could write a servlet filter as the following one:

public void doFilter(ServletRequest request, ServletResponse response, FilterChain filterChain) throws IOException, ServletException {

    HttpServletRequest httpServletRequest = (HttpServletRequest) request;

    HttpServletResponse httpServletResponse = (HttpServletResponse) response;

    // if errors exist then create a sanitized cookie header and continue

    SecurityWrapperResponse securityWrapperResponse = new SecurityWrapperResponse(httpServletResponse, "sanitize");

    Cookie[] cookies = httpServletRequest.getCookies();

    if (cookies != null) {

        for (int i = 0; i < cookies.length; i++) {

            Cookie cookie = cookies[i];

            if (cookie != null) {

                // ESAPI.securityConfiguration().getHttpSessionIdName() returns JSESSIONID by default configuration

                if (ESAPI.securityConfiguration().getHttpSessionIdName().equals(cookie.getName())) {

                    securityWrapperResponse.addCookie(cookie);

                }

            }

        }

    }

    filterChain.doFilter(request, response);

}

Some web application servers, that implements JEE 5, and servlet
container that implements Java Servlet 2.5 (part of the JEE 5), also
allow creating HttpOnly session cookies:

• Tomcat 6 In context.xml set the
  context tag‘s attribute useHttpOnly [7] as follow:

<?xml version="1.0" encoding="UTF-8"?>

<Context path="/myWebApplicationPath" useHttpOnly="true">

• JBoss 5.0.1 and JBOSS EAP
  5.0.1 In
  \server\<myJBossServerInstance>\deploy\jbossweb.sar\context.xml
  set the SessionCookie tag [8]
  as follow:

<Context cookies="true" crossContext="true">

  <SessionCookie secure="true" httpOnly="true" />

Using
.NET to Set HttpOnly

• By default, .NET 2.0 sets the
  HttpOnly attribute for
  
  1. Session ID
  
  
  2. Forms Authentication cookie

In .NET 2.0, HttpOnly can also be set via the HttpCookie
object for all custom application cookies

• Via web.config in the system.web/httpCookies
  element

<httpCookies httpOnlyCookies="true" …>

• Or programmatically

C# Code:

HttpCookie myCookie = new HttpCookie("myCookie");

myCookie.HttpOnly = true;

Response.AppendCookie(myCookie);

VB.NET Code:

Dim myCookie As HttpCookie = new HttpCookie("myCookie")

myCookie.HttpOnly = True

Response.AppendCookie(myCookie)

• However, in .NET 1.1, you would have to do
  this manually, e.g.,

Response.Cookies[cookie].Path += ";HttpOnly";

Using
Python (cherryPy) to Set HttpOnly

Python Code (cherryPy):
To use HTTP-Only cookies with Cherrypy
sessions just add the following line in your configuration file:

tools.sessions.httponly = True

If you use SLL you can also make your cookies secure (encrypted)
to avoid "man in the middle" cookies reading with:

tools.sessions.secure = True

Using PHP to set HttpOnly

PHP supports setting the HttpOnly flag since version 5.2.0
(November 2006).

For session cookies managed by PHP, the flag is set either
permanently in php.iniPHP manual on HttpOnly through the
parameter:

session.cookie_httponly = True

or in and during a script via the function[9]:

void session_set_cookie_params  ( int $lifetime  [, string $path  [, string $domain

                                  [, bool $secure= false  [, bool $httponly= false  ]]]] )

For application cookies last parameter in setcookie() sets
HttpOnly flag[10]:

bool setcookie  ( string $name  [, string $value  [, int $expire= 0  [, string $path

                 [, string $domain  [, bool $secure= false  [, bool $httponly= false  ]]]]]] )

Web
Application Firewalls

If code changes are infeasible, web application firewalls can be
used to add HttpOnly to session cookies:

• Mod_security - using SecRule and Header directives[11]


• ESAPI WAF[12] using add-http-only-flag
  directive[13]

Browsers Supporting HttpOnly

Using WebGoat‘s HttpOnly lesson, the following web browsers have
been tested for HttpOnly support. If the browsers enforces HttpOnly,
a client side script will be unable to read or write the session
cookie. However, there is currently no prevention of reading or
writing the session cookie via a XMLHTTPRequest.

Note: These results may be out of date as this page is not well
maintained. A great site that is focused on keeping up with the
status of browsers is at: http://www.browserscope.org/. For the most recent
security status of various browsers, including many details beyond
just HttpOnly, go to the browserscope site, and then click on the
Security Tab on the table at the bottom of the page. The
Browserscope site does not provide as much detail on HttpOnly as
this page, but provides lots of other details this page does
not.

Our results as of Feb 2009 are listed below in table
1.

* An attacker could still read the session cookie in a response
to an XmlHttpRequest.

As of 2011, 99% of browsers and most web application frameworks
do support httpOnly<ref>Misunderstandings on HttpOnly
Cookie</ref>.

Using WebGoat to Test for HttpOnly Support

The goal of this section is to provide a step-by-step example of
testing your browser for HttpOnly support.

WARNING

The OWASP WEBGOAT HttpOnly lab is broken and does not show IE 8
Beta 2 with ms08-069 as complete in terms of HttpOnly XMLHTTPRequest
header leakage protection. This error is being tracked via http://code.google.com/p/webgoat/issues/detail?id=18.

Getting Started

Figure 1 - Accessing
WebGoat‘s HttpOnly Test Lesson

Assuming you have installed and launched WebGoat, begin by
navigating to the ‘HttpOnly Test’ lesson located
within the Cross-Site Scripting (XSS) category.
After loading the ‘HttpOnly Test’ lesson, as shown in figure
1, you are now able to begin testing web browsers
supporting HTTPOnly.

Lesson Goal

If the HttpOnly flag is set, then your browser should
not allow a client-side script to access the session cookie.
Unfortunately, since the attribute is relatively new, several
browsers may neglect to handle the new attribute properly.

The purpose of this lesson is to test whether
your browser supports the HttpOnly cookie flag.
Note the value of the unique2u
cookie. If your browser supports HTTPOnly, and you
enable it for a cookie, a client-side script should NOT be
able to read OR write to that cookie, but the browser can still send
its value to the server. However, some browsers only prevent client
side read access, but do not prevent write access.

Testing Web Browsers for HttpOnly Support

The following test was performed on two browsers,
Internet Explorer 7 and Opera
9.22, to demonstrate the results when the HttpOnly flag is
enforced properly. As you will see, IE7 properly enforces the
HttpOnly flag, whereas Opera does not properly enforce the HttpOnly
flag.

Disabling HttpOnly

1) Select the option to turn HttpOnly off as shown below in figure 2.

Figure 2 - Disabling
HttpOnly

2) After turning HttpOnly off, select the “Read Cookie” button.

• An alert dialog box will display on the screen notifying you
  that since HttpOnly was not enabled, the
  ‘unique2u’ cookie was successfully read as shown
  below in figure 3.

Figure 3 - Cookie Successfully Read with
HttpOnly Off

3) With HttpOnly remaining disabled, select the “Write Cookie”  button.

• An alert dialog box will display on the screen notifying you
  that since HttpOnly was not enabled, the
  ‘unique2u’ cookie was successfully modified on
  the client side as shown below in figure 4.

Figure 4 - Cookie Successfully Written
with HttpOnly Off

• As you have seen thus far, browsing without
  HttpOnly on is a potential
  threat. Next, we will enable
  HttpOnly to demonstrate how this flag protects the
  cookie.

Enabling HttpOnly

4) Select the radio button to enable HttpOnly as shown below in figure 5.

Figure 5 - Enabling
HttpOnly

5) After enabling HttpOnly, select the "Read Cookie" button.

• If the browser enforces the HttpOnly flag properly, an alert
  dialog box will display only the session ID rather than the
  contents of the ‘unique2u’ cookie as shown below
  in figure 6.

Figure 6 - Enforced Cookie Read
Protection

• However, if the browser does not enforce the HttpOnly flag
  properly, an alert dialog box will display both the
  ‘unique2u’ cookie and session ID as shown below
  in figure 7.

Figure 7 - Unenforced Cookie Read
Protection

• Finally, we will test if the browser allows write
  access to the cookie with HttpOnly enabled.

6) Select the "Write Cookie" button.

• If the browser enforces the HttpOnly flag properly, client
  side modification will be unsuccessful in writing to the
  ‘unique2u’ cookie and an alert dialog box will
  display only containing the session ID as shown below in
  figure 8.

Figure 8 - Enforced Cookie Write
Protection

• However, if the browser does not enforce the write protection
  property of HttpOnly flag for the ‘unique2u’
  cookie, the cookie will be successfully modified to
  HACKED on the client side as shown below in
  figure 9.

Figure 9 - Unenforced Cookie Write
Protection

References

[1] Wiens, Jordan. No cookie for you!"

[2] Mitigating Cross-site Scripting with HTTP-Only
Cookies

[3] Howard, Michael. Some Bad News and Some Good News

[4] MSDN. Setting the HttpOnly propery in .NET

[5] XSS: Gaining access to HttpOnly Cookie in
2012